Master interface index:
Module:
authlogin
Layer:
system
auth_domtrans_login_program(
domain
,
target_domain
)
Module:
authlogin
Layer:
system
auth_manage_all_files_except_shadow(
domain
,
[
exception_types
]
)
Module:
authlogin
Layer:
system
auth_relabel_all_files_except_shadow(
domain
,
[
exception_types
]
)
Module:
authlogin
Layer:
system
auth_run_utempter(
domain
,
role
,
terminal
)
Module:
bootloader
Layer:
kernel
bootloader_create_kernel_symbol_table(
domain
)
Module:
bootloader
Layer:
kernel
bootloader_delete_kernel_symbol_table(
domain
)
Module:
clock
Layer:
system
clock_run(
domain
,
role
,
terminal
)
Module:
corecommands
Layer:
system
corecmd_getattr_bin_file(
domain
)
Get the attributes of files in bin directories.
Module:
corecommands
Layer:
system
corecmd_read_bin_symlink(
domain
)
Read symbolic links in bin directories.
Module:
corecommands
Layer:
system
corecmd_read_sbin_symlink(
domain
)
Read symbolic links in sbin directories.
Module:
corecommands
Layer:
system
corecmd_shell_entry_type(
domain
)
Make the shell an entrypoint for the specified domain.
Module:
corenetwork
Layer:
kernel
corenet_dontaudit_tcp_bind_all_reserved_ports(
domain
)
Do not audit attempts to bind TCP sockets to all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_dontaudit_udp_bind_all_reserved_ports(
domain
)
Do not audit attempts to bind UDP sockets to all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_raw_receive_all_if(
domain
)
Receive raw IP packets on all interfaces.
Module:
corenetwork
Layer:
kernel
corenet_raw_receive_all_nodes(
domain
)
Receive raw IP packets on all nodes.
Module:
corenetwork
Layer:
kernel
corenet_raw_receive_generic_if(
domain
)
Receive raw IP packets on generic interfaces.
Module:
corenetwork
Layer:
kernel
corenet_raw_receive_generic_node(
domain
)
Receive raw IP packets on generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_raw_send_all_if(
domain
)
Send raw IP packets on all interfaces.
Module:
corenetwork
Layer:
kernel
corenet_raw_send_all_nodes(
domain
)
Send raw IP packets on all nodes.
Module:
corenetwork
Layer:
kernel
corenet_raw_send_generic_if(
domain
)
Send raw IP packets on generic interfaces.
Module:
corenetwork
Layer:
kernel
corenet_raw_send_generic_node(
domain
)
Send raw IP packets on generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_raw_sendrecv_all_if(
domain
)
Send and receive raw IP packets on all interfaces.
Module:
corenetwork
Layer:
kernel
corenet_raw_sendrecv_all_nodes(
domain
)
Send and receive raw IP packets on all nodes.
Module:
corenetwork
Layer:
kernel
corenet_raw_sendrecv_generic_if(
domain
)
Send and receive raw IP packets on generic interfaces.
Module:
corenetwork
Layer:
kernel
corenet_raw_sendrecv_generic_node(
domain
)
Send and receive raw IP packets on generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_tcp_bind_all_nodes(
domain
)
Bind TCP sockets to all nodes.
Module:
corenetwork
Layer:
kernel
corenet_tcp_bind_all_ports(
domain
)
Bind TCP sockets to all ports.
Module:
corenetwork
Layer:
kernel
corenet_tcp_bind_all_reserved_ports(
domain
)
Bind TCP sockets to all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_tcp_bind_generic_node(
domain
)
Bind TCP sockets to generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_tcp_bind_generic_port(
domain
)
Bind TCP sockets to generic ports.
Module:
corenetwork
Layer:
kernel
corenet_tcp_bind_reserved_port(
domain
)
Bind TCP sockets to generic reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_all_if(
domain
)
Send and receive TCP network traffic on all interfaces.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_all_nodes(
domain
)
Send and receive TCP network traffic on all nodes.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_all_ports(
domain
)
Send and receive TCP network traffic on all ports.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_all_reserved_ports(
domain
)
Send and receive TCP network traffic on all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_generic_if(
domain
)
Send and receive TCP network traffic on the generic interfaces.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_generic_node(
domain
)
Send and receive TCP network traffic on generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_generic_port(
domain
)
Send and receive TCP network traffic on generic ports.
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_kerberos_master_port(
domain
)
Module:
corenetwork
Layer:
kernel
corenet_tcp_sendrecv_reserved_port(
domain
)
Send and receive TCP network traffic on generic reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_bind_all_nodes(
domain
)
Bind UDP sockets to all nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_bind_all_ports(
domain
)
Bind UDP sockets to all ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_bind_all_reserved_ports(
domain
)
Bind UDP sockets to all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_bind_generic_node(
domain
)
Bind UDP sockets to generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_bind_generic_port(
domain
)
Bind UDP sockets to generic ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_bind_reserved_port(
domain
)
Bind UDP sockets to generic reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_all_if(
domain
)
Receive UDP network traffic on all interfaces.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_all_nodes(
domain
)
Receive UDP network traffic on all nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_all_ports(
domain
)
Receive UDP network traffic on all ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_all_reserved_ports(
domain
)
Receive UDP network traffic on all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_generic_if(
domain
)
Receive UDP network traffic on generic interfaces.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_generic_node(
domain
)
Receive UDP network traffic on generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_generic_port(
domain
)
Receive UDP network traffic on generic ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_receive_reserved_port(
domain
)
Receive UDP network traffic on generic reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_all_if(
domain
)
Send UDP network traffic on all interfaces.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_all_nodes(
domain
)
Send UDP network traffic on all nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_all_ports(
domain
)
Send UDP network traffic on all ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_all_reserved_ports(
domain
)
Send UDP network traffic on all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_generic_if(
domain
)
Send UDP network traffic on generic interfaces.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_generic_node(
domain
)
Send UDP network traffic on generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_generic_port(
domain
)
Send UDP network traffic on generic ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_send_reserved_port(
domain
)
Send UDP network traffic on generic reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_all_if(
domain
)
Send and receive UDP network traffic on all interfaces.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_all_nodes(
domain
)
Send and receive UDP network traffic on all nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_all_ports(
domain
)
Send and receive UDP network traffic on all ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_all_reserved_ports(
domain
)
Send and receive UDP network traffic on all reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_generic_if(
domain
)
Send and Receive UDP network traffic on generic interfaces.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_generic_node(
domain
)
Send and receive UDP network traffic on generic nodes.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_generic_port(
domain
)
Send and receive UDP network traffic on generic ports.
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_kerberos_master_port(
domain
)
Module:
corenetwork
Layer:
kernel
corenet_udp_sendrecv_reserved_port(
domain
)
Send and receive UDP network traffic on generic reserved ports.
Module:
corenetwork
Layer:
kernel
corenet_unconfined(
domain
)
Unconfined access to network objects.
Module:
corenetwork
Layer:
kernel
corenet_use_tun_tap_device(
domain
)
Read and write the TUN/TAP virtual network device.
Module:
cron
Layer:
services
cron_read_pipe(
domain
)
Read a cron daemon unnamed pipe
Module:
cron
Layer:
services
cron_rw_log(
domain
)
Read and write the cron daemon log files.
Module:
cron
Layer:
services
cron_search_spool(
domain
)
Search the directory containing user cron tables.
Module:
cron
Layer:
services
cron_system_entry(
domain
,
entrypoint
)
Make the specified program domain accessable
from the system cron jobs.
Module:
devices
Layer:
kernel
dev_create_dev_node(
domain
,
file
,
objectclass(es)
)
Create, read, and write device nodes. The node
will be transitioned to the type provided.
Module:
devices
Layer:
kernel
dev_create_dir(
domain
)
Create a directory in the device directory.
Module:
devices
Layer:
kernel
dev_create_generic_chr_file(
domain
)
Allow read, write, and create for generic character device files.
Module:
devices
Layer:
kernel
dev_del_generic_symlinks(
domain
)
Delete symbolic links in device directories.
Module:
devices
Layer:
kernel
dev_delete_lvm_control(
domain
)
Delete the lvm control device.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_all_blk_files(
domain
)
Dontaudit getattr on all block file device nodes.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_all_chr_files(
domain
)
Dontaudit getattr on all character file device nodes.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_apm_bios(
domain
)
Do not audit attempts to get the attributes of
the apm bios device node.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_generic_blk_file(
domain
)
Dontaudit getattr on generic block devices.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_generic_chr_file(
domain
)
Dontaudit getattr for generic character device files.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_generic_pipe(
domain
)
Dontaudit getattr on generic pipes.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_misc(
domain
)
Do not audit attempts to get the attributes
of miscellaneous devices.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_scanner(
domain
)
Do not audit attempts to get the attributes of
the scanner device.
Module:
devices
Layer:
kernel
dev_dontaudit_getattr_video_dev(
domain
)
Do not audit attempts to get the attributes
of video4linux device nodes.
Module:
devices
Layer:
kernel
dev_dontaudit_list_all_dev_nodes(
domain
)
Dontaudit attempts to list all device nodes.
Module:
devices
Layer:
kernel
dev_dontaudit_read_framebuffer(
domain
)
Do not audit attempts to read the framebuffer.
Module:
devices
Layer:
kernel
dev_dontaudit_rw_dri_dev(
domain
)
Dontaudit read and write on the dri devices.
Module:
devices
Layer:
kernel
dev_dontaudit_rw_generic_dev_nodes(
domain
)
Dontaudit getattr for generic device files.
Module:
devices
Layer:
kernel
dev_dontaudit_search_sysfs(
domain
)
Do not audit attempts to search sysfs.
Module:
devices
Layer:
kernel
dev_dontaudit_setattr_apm_bios(
domain
)
Do not audit attempts to set the attributes of
the apm bios device node.
Module:
devices
Layer:
kernel
dev_dontaudit_setattr_framebuffer(
domain
)
Dot not audit attempts to set the attributes
of the framebuffer device node.
Module:
devices
Layer:
kernel
dev_dontaudit_setattr_generic_blk_file(
domain
)
Dontaudit setattr on generic block devices.
Module:
devices
Layer:
kernel
dev_dontaudit_setattr_generic_chr_file(
domain
)
Dontaudit setattr for generic character device files.
Module:
devices
Layer:
kernel
dev_dontaudit_setattr_misc(
domain
)
Do not audit attempts to set the attributes
of miscellaneous devices.
Module:
devices
Layer:
kernel
dev_dontaudit_setattr_scanner(
domain
)
Do not audit attempts to set the attributes of
the scanner device.
Module:
devices
Layer:
kernel
dev_dontaudit_setattr_video_dev(
domain
)
Do not audit attempts to set the attributes
of video4linux device nodes.
Module:
devices
Layer:
kernel
dev_getattr_all_blk_files(
domain
)
Getattr on all block file device nodes.
Module:
devices
Layer:
kernel
dev_getattr_all_chr_files(
domain
)
Getattr on all character file device nodes.
Module:
devices
Layer:
kernel
dev_getattr_apm_bios(
domain
)
Get the attributes of the apm bios device node.
Module:
devices
Layer:
kernel
dev_getattr_framebuffer(
domain
)
Get the attributes of the framebuffer device node.
Module:
devices
Layer:
kernel
dev_getattr_generic_blk_file(
domain
)
Allow getattr on generic block devices.
Module:
devices
Layer:
kernel
dev_getattr_generic_chr_file(
domain
)
Allow getattr for generic character device files.
Module:
devices
Layer:
kernel
dev_getattr_misc(
domain
)
Get the attributes of miscellaneous devices.
Module:
devices
Layer:
kernel
dev_getattr_mouse(
domain
)
Get the attributes of the mouse devices.
Module:
devices
Layer:
kernel
dev_getattr_power_management(
domain
)
Get the attributes of the the power management device.
Module:
devices
Layer:
kernel
dev_getattr_scanner(
domain
)
Get the attributes of the scanner device.
Module:
devices
Layer:
kernel
dev_getattr_snd_dev(
domain
)
Get the attributes of the sound devices.
Module:
devices
Layer:
kernel
dev_getattr_sysfs_dir(
domain
)
Get the attributes of sysfs directories.
Module:
devices
Layer:
kernel
dev_getattr_video_dev(
domain
)
Get the attributes of video4linux devices.
Module:
devices
Layer:
kernel
dev_list_all_dev_nodes(
domain
)
List all of the device nodes in a device directory.
Module:
devices
Layer:
kernel
dev_list_usbfs(
domain
)
Allow caller to get a list of usb hardware.
Module:
devices
Layer:
kernel
dev_manage_all_blk_files(
domain
)
Read, write, create, and delete all block device files.
Module:
devices
Layer:
kernel
dev_manage_all_chr_files(
domain
)
Read, write, create, and delete all character device files.
Module:
devices
Layer:
kernel
dev_manage_dev_nodes(
domain
)
Create, delete, read, and write device nodes in device directories.
Module:
devices
Layer:
kernel
dev_manage_generic_blk_file(
domain
)
Allow read, write, create, and delete for generic
block files.
Module:
devices
Layer:
kernel
dev_manage_generic_blk_file(
domain
)
Create, delete, read, and write block device files.
Module:
devices
Layer:
kernel
dev_manage_generic_chr_file(
domain
)
Create, delete, read, and write character device files.
Module:
devices
Layer:
kernel
dev_manage_generic_symlinks(
domain
)
Create, delete, read, and write symbolic links in device directories.
Module:
devices
Layer:
kernel
dev_mount_usbfs(
domain
)
Mount a usbfs filesystem.
Module:
devices
Layer:
kernel
dev_node(
object_type
)
Make the passed in type a type appropriate for
use on device nodes (usually files in /dev).
Module:
devices
Layer:
kernel
dev_read_cpuid(
domain
)
Read the multiplexed input device (/dev/input).
Module:
devices
Layer:
kernel
dev_read_input(
domain
)
Read the multiplexed input device (/dev/input).
Module:
devices
Layer:
kernel
dev_read_lvm_control(
domain
)
Read the lvm comtrol device.
Module:
devices
Layer:
kernel
dev_read_misc(
domain
)
Read miscellaneous devices.
Module:
devices
Layer:
kernel
dev_read_rand(
domain
)
Read from random devices (e.g., /dev/random)
Module:
devices
Layer:
kernel
dev_read_raw_memory(
domain
)
Read raw memory devices (e.g. /dev/mem).
Module:
devices
Layer:
kernel
dev_read_realtime_clock(
domain
)
Read the realtime clock (/dev/rtc).
Module:
devices
Layer:
kernel
dev_read_snd_mixer_dev(
domain
)
Read the sound mixer devices.
Module:
devices
Layer:
kernel
dev_read_sysfs(
domain
)
Allow caller to read hardware state information.
Module:
devices
Layer:
kernel
dev_read_urand(
domain
)
Read from pseudo random devices (e.g., /dev/urandom)
Module:
devices
Layer:
kernel
dev_read_usbfs(
domain
)
Read USB hardware information using
the usbfs filesystem interface.
Module:
devices
Layer:
kernel
dev_relabel_all_dev_nodes(
domain
)
Allow full relabeling (to and from) of all device nodes.
Module:
devices
Layer:
kernel
dev_relabel_dev_dirs(
domain
)
Allow full relabeling (to and from) of directories in /dev.
Module:
devices
Layer:
kernel
dev_relabel_generic_symlinks(
domain
)
Relabel symbolic links in device directories.
Module:
devices
Layer:
kernel
dev_rw_agp_dev(
domain
)
Read and write the agp devices.
Module:
devices
Layer:
kernel
dev_rw_apm_bios(
domain
)
Read and write the apm bios.
Module:
devices
Layer:
kernel
dev_rw_cpu_microcode(
domain
)
Read and write the the cpu microcode device. This
is required to load cpu microcode.
Module:
devices
Layer:
kernel
dev_rw_dri_dev(
domain
)
Read and write the dri devices.
Module:
devices
Layer:
kernel
dev_rw_lvm_control(
domain
)
Read and write the lvm control device.
Module:
devices
Layer:
kernel
dev_rw_null_dev(
domain
)
Read and write to the null device (/dev/null).
Module:
devices
Layer:
kernel
dev_rw_power_management(
domain
)
Read and write the the power management device.
Module:
devices
Layer:
kernel
dev_rw_realtime_clock(
domain
)
Read the realtime clock (/dev/rtc).
Module:
devices
Layer:
kernel
dev_rw_scanner(
domain
)
Read and write the scanner device.
Module:
devices
Layer:
kernel
dev_rw_sysfs(
domain
)
Allow caller to modify hardware state information.
Module:
devices
Layer:
kernel
dev_rw_usbfs(
domain
)
Allow caller to modify usb hardware configuration files.
Module:
devices
Layer:
kernel
dev_rw_zero_dev(
domain
)
Read and write to the zero device (/dev/zero).
Module:
devices
Layer:
kernel
dev_rwx_zero_dev(
domain
)
Read, write, and execute the zero device (/dev/zero).
Module:
devices
Layer:
kernel
dev_rx_raw_memory(
domain
)
Read and execute raw memory devices (e.g. /dev/mem).
Module:
devices
Layer:
kernel
dev_search_usbfs(
domain
)
Search the directory containing USB hardware information.
Module:
devices
Layer:
kernel
dev_setattr_all_blk_files(
domain
)
Setattr on all block file device nodes.
Module:
devices
Layer:
kernel
dev_setattr_all_chr_files(
domain
)
Setattr on all character file device nodes.
Module:
devices
Layer:
kernel
dev_setattr_apm_bios(
domain
)
Set the attributes of the apm bios device node.
Module:
devices
Layer:
kernel
dev_setattr_framebuffer(
domain
)
Set the attributes of the framebuffer device node.
Module:
devices
Layer:
kernel
dev_setattr_misc(
domain
)
Set the attributes of miscellaneous devices.
Module:
devices
Layer:
kernel
dev_setattr_mouse(
domain
)
Set the attributes of the mouse devices.
Module:
devices
Layer:
kernel
dev_setattr_power_management(
domain
)
Set the attributes of the the power management device.
Module:
devices
Layer:
kernel
dev_setattr_scanner(
domain
)
Set the attributes of the scanner device.
Module:
devices
Layer:
kernel
dev_setattr_snd_dev(
domain
)
Set the attributes of the sound devices.
Module:
devices
Layer:
kernel
dev_setattr_video_dev(
domain
)
Set the attributes of video4linux device nodes.
Module:
devices
Layer:
kernel
dev_unconfined(
domain
)
Unconfined access to devices.
Module:
devices
Layer:
kernel
dev_write_misc(
domain
)
Write miscellaneous devices.
Module:
devices
Layer:
kernel
dev_write_rand(
domain
)
Write to the random device (e.g., /dev/random). This adds
entropy used to generate the random data read from the
random device.
Module:
devices
Layer:
kernel
dev_write_raw_memory(
domain
)
Write raw memory devices (e.g. /dev/mem).
Module:
devices
Layer:
kernel
dev_write_realtime_clock(
domain
)
Read the realtime clock (/dev/rtc).
Module:
devices
Layer:
kernel
dev_write_snd_mixer_dev(
domain
)
Write the sound mixer devices.
Module:
devices
Layer:
kernel
dev_write_urand(
domain
)
Write to the pseudo random device (e.g., /dev/urandom). This
sets the random number generator seed.
Module:
devices
Layer:
kernel
dev_wx_raw_memory(
domain
)
Write and execute raw memory devices (e.g. /dev/mem).
Module:
dmesg
Layer:
admin
dmesg_domtrans(
domain
)
Module:
domain
Layer:
system
domain_dontaudit_getattr_all_tcp_sockets(
domain
)
Module:
domain
Layer:
system
domain_dontaudit_getattr_all_udp_sockets(
domain
)
Module:
domain
Layer:
system
domain_dontaudit_getattr_all_unix_dgram_sockets(
domain
)
Module:
domain
Layer:
system
domain_dontaudit_getattr_all_unnamed_pipes(
domain
)
Module:
domain
Layer:
system
domain_dontaudit_list_all_domains_proc(
domain
)
Module:
domain
Layer:
system
domain_dontaudit_use_wide_inherit_fd(
?
)
Module:
domain
Layer:
system
domain_exec_all_entry_files(
?
)
Module:
domain
Layer:
system
domain_getsession_all_domains(
domain
)
Module:
domain
Layer:
system
domain_kill_all_domains(
domain
)
Module:
domain
Layer:
system
domain_obj_id_change_exempt(
domain
)
Module:
domain
Layer:
system
domain_read_all_domains_state(
domain
)
Module:
domain
Layer:
system
domain_read_all_entry_files(
?
)
Module:
domain
Layer:
system
domain_role_change_exempt(
domain
)
Module:
domain
Layer:
system
domain_setpriority_all_domains(
?
)
Module:
domain
Layer:
system
domain_sigchld_all_domains(
domain
)
Module:
domain
Layer:
system
domain_sigchld_wide_inherit_fd(
domain
)
Send a SIGCHLD signal to domains whose file
discriptors are widely inheritable.
Module:
domain
Layer:
system
domain_signal_all_domains(
domain
)
Module:
domain
Layer:
system
domain_signull_all_domains(
domain
)
Module:
domain
Layer:
system
domain_sigstop_all_domains(
domain
)
Module:
domain
Layer:
system
domain_subj_id_change_exempt(
domain
)
Module:
domain
Layer:
system
domain_unconfined(
domain
)
Unconfined access to domains.
Module:
domain
Layer:
system
domain_use_wide_inherit_fd(
?
)
Module:
files
Layer:
system
files_create_boot_flag(
?
)
Module:
files
Layer:
system
files_create_etc_config(
?
)
Module:
files
Layer:
system
files_create_home_dirs(
domain
,
home_type
)
Module:
files
Layer:
system
files_create_root(
domain
,
[
private type
]
,
[
object
]
)
Module:
files
Layer:
system
files_create_tmp_files(
?
)
Module:
files
Layer:
system
files_delete_all_locks(
?
)
Module:
files
Layer:
system
files_delete_all_tmp_files(
?
)
Module:
files
Layer:
system
files_delete_etc_files(
domain
)
Module:
files
Layer:
system
files_delete_root_dir_entry(
?
)
Module:
files
Layer:
system
files_dontaudit_ioctl_all_pids(
domain
)
Module:
files
Layer:
system
files_dontaudit_read_root_file(
?
)
Module:
files
Layer:
system
files_dontaudit_rw_root_chr_dev(
?
)
Module:
files
Layer:
system
files_dontaudit_rw_root_file(
?
)
Module:
files
Layer:
system
files_dontaudit_search_all_dirs(
?
)
Module:
files
Layer:
system
files_dontaudit_search_isid_type_dir(
domain
)
Do not audit attempts to search directories on new filesystems
that have not yet been labeled.
Module:
files
Layer:
system
files_dontaudit_search_pids(
?
)
Module:
files
Layer:
system
files_dontaudit_search_var(
?
)
Module:
files
Layer:
system
files_dontaudit_write_all_pids(
domain
)
Module:
files
Layer:
system
files_exec_usr_files(
domain
)
Module:
files
Layer:
system
files_getattr_all_files(
?
)
Module:
files
Layer:
system
files_getattr_generic_locks(
?
)
Module:
files
Layer:
system
files_list_home(
domain
)
Get listing of home directories.
Module:
files
Layer:
system
files_manage_all_files(
domain
,
[
exception_types
]
)
Module:
files
Layer:
system
files_manage_etc_files(
?
)
Module:
files
Layer:
system
files_manage_etc_runtime_files(
?
)
Module:
files
Layer:
system
files_manage_generic_locks(
?
)
Module:
files
Layer:
system
files_manage_generic_spool_dirs(
?
)
Module:
files
Layer:
system
files_manage_generic_spools(
?
)
Module:
files
Layer:
system
files_manage_isid_type_blk_node(
domain
)
Create, read, write, and delete block device nodes
on new filesystems that have not yet been labeled.
Module:
files
Layer:
system
files_manage_isid_type_chr_node(
domain
)
Create, read, write, and delete character device nodes
on new filesystems that have not yet been labeled.
Module:
files
Layer:
system
files_manage_isid_type_dir(
domain
)
Create, read, write, and delete directories
on new filesystems that have not yet been labeled.
Module:
files
Layer:
system
files_manage_isid_type_file(
domain
)
Create, read, write, and delete files
on new filesystems that have not yet been labeled.
Module:
files
Layer:
system
files_manage_isid_type_symlink(
domain
)
Create, read, write, and delete symbolic links
on new filesystems that have not yet been labeled.
Module:
files
Layer:
system
files_manage_lost_found(
domain
)
Create, read, write, and delete objects in
lost+found directories.
Module:
files
Layer:
system
files_manage_urandom_seed(
?
)
Module:
files
Layer:
system
files_mount_all_file_type_fs(
?
)
Module:
files
Layer:
system
files_mounton_all_mountpoints(
?
)
Module:
files
Layer:
system
files_read_etc_runtime_files(
?
)
Module:
files
Layer:
system
files_read_generic_spools(
?
)
Module:
files
Layer:
system
files_read_usr_src_files(
?
)
Module:
files
Layer:
system
files_read_var_files(
domain
)
Read files in the /var directory.
Module:
files
Layer:
system
files_relabel_all_files(
domain
,
[
exception_types
]
)
Module:
files
Layer:
system
files_relabelto_all_file_type_fs(
?
)
Module:
files
Layer:
system
files_rw_isid_type_blk_node(
domain
)
Read and write block device nodes on new filesystems
that have not yet been labeled.
Module:
files
Layer:
system
files_rw_isid_type_dir(
domain
)
Read and write directories on new filesystems
that have not yet been labeled.
Module:
files
Layer:
system
files_search_generic_locks(
?
)
Module:
files
Layer:
system
files_search_home(
domain
)
Module:
files
Layer:
system
files_search_tmp(
domain
)
Search the tmp directory (/tmp)
Module:
files
Layer:
system
files_search_var_lib(
domain
)
Module:
files
Layer:
system
files_unconfined(
domain
)
Unconfined access to files.
Module:
files
Layer:
system
files_unmount_all_file_type_fs(
?
)
Module:
filesystem
Layer:
kernel
fs_search_auto_mountpoints(
domain
)
Search automount filesystem to use automatically
mounted filesystems.
Module:
filesystem
Layer:
kernel
fs_unconfined(
domain
)
Unconfined access to filesystems
Module:
fstools
Layer:
system
fstools_run(
domain
,
role
,
terminal
)
Module:
getty
Layer:
system
getty_modify_config(
domain
)
Module:
getty
Layer:
system
getty_read_config(
domain
)
Module:
hostname
Layer:
system
hostname_run(
domain
,
role
,
terminal
)
Module:
hotplug
Layer:
system
hotplug_dontaudit_search_config(
?
)
Module:
inetd
Layer:
services
inetd_core_service_domain(
domain
,
entrypoint
)
Define the specified domain as a inetd service.
Module:
inetd
Layer:
services
inetd_service_domain(
domain
,
entrypoint
)
Define the specified domain as a TCP and UDP inetd service.
Module:
inetd
Layer:
services
inetd_tcp_service_domain(
domain
,
entrypoint
)
Define the specified domain as a TCP inetd service.
Module:
inetd
Layer:
services
inetd_udp_service_domain(
domain
,
entrypoint
)
Define the specified domain as a UDP inetd service.
Module:
init
Layer:
system
init_daemon_domain(
domain
,
entry_point
)
Create a domain for long running processes
(daemons) which can be started by init scripts.
Module:
init
Layer:
system
init_domain(
domain
,
entry_point
)
Create a domain which can be started by init.
Module:
init
Layer:
system
init_domtrans_script(
?
)
Module:
init
Layer:
system
init_dontaudit_getattr_initctl(
?
)
Module:
init
Layer:
system
init_dontaudit_rw_script_pid(
?
)
Module:
init
Layer:
system
init_dontaudit_use_fd(
?
)
Module:
init
Layer:
system
init_dontaudit_use_initctl(
?
)
Module:
init
Layer:
system
init_dontaudit_use_script_fd(
?
)
Module:
init
Layer:
system
init_dontaudit_use_script_pty(
?
)
Module:
init
Layer:
system
init_dontaudit_write_script_pid(
?
)
Module:
init
Layer:
system
init_get_process_group(
?
)
Module:
init
Layer:
system
init_get_script_process_group(
?
)
Module:
init
Layer:
system
init_getattr_initctl(
?
)
Module:
init
Layer:
system
init_read_script_pid(
?
)
Module:
init
Layer:
system
init_read_script_process_state(
domain
)
Read the process state (/proc/pid) of the init scripts.
Module:
init
Layer:
system
init_run_daemon(
domain
,
role
,
terminal
)
Module:
init
Layer:
system
init_rw_script_pid(
?
)
Module:
init
Layer:
system
init_rw_script_pipe(
domain
)
Read and write init script unnamed pipes.
Module:
init
Layer:
system
init_rw_script_tmp_files(
domain
)
Read and write init script temporary data.
Module:
init
Layer:
system
init_system_domain(
domain
,
entry_point
)
Create a domain for short running processes
which can be started by init scripts.
Module:
init
Layer:
system
init_udp_sendto_script(
domain
)
Send UDP network traffic to init scripts.
Module:
init
Layer:
system
init_use_script_fd(
?
)
Module:
init
Layer:
system
init_use_script_pty(
?
)
Module:
init
Layer:
system
init_write_initctl(
?
)
Module:
iptables
Layer:
system
iptables_run(
domain
,
role
,
terminal
)
Module:
kerberos
Layer:
services
kerberos_read_conf(
domain
)
Read the kerberos configuration file (/etc/krb5.conf).
Module:
kernel
Layer:
kernel
kernel_change_ring_buffer_level(
domain
)
Change the level of kernel messages logged to the console.
Module:
kernel
Layer:
kernel
kernel_clear_ring_buffer(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_getattr_core(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_getattr_message_if(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_getattr_unlabeled_blk_dev(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_read_ring_buffer(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_read_system_state(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_search_network_sysctl_dir(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_search_sysctl_dir(
domain
)
Module:
kernel
Layer:
kernel
kernel_dontaudit_use_fd(
domain
)
Module:
kernel
Layer:
kernel
kernel_get_sysvipc_info(
domain
)
Module:
kernel
Layer:
kernel
kernel_getattr_message_if(
domain
)
Module:
kernel
Layer:
kernel
kernel_kill_unlabeled(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_all_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_device_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_fs_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_hotplug_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_irq_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_kernel_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_modprobe_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_net_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_network_state(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_ring_buffer(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_software_raid_state(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_system_state(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_unix_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_read_vm_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_relabel_unlabeled(
domain
)
Module:
kernel
Layer:
kernel
kernel_rootfs_mountpoint(
directory_type
)
Module:
kernel
Layer:
kernel
kernel_rw_device_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_rw_hotplug_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_rw_kernel_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_rw_modprobe_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_rw_unix_sysctl(
domain
)
Module:
kernel
Layer:
kernel
kernel_sigchld_unlabeled(
domain
)
Module:
kernel
Layer:
kernel
kernel_signal_unlabeled(
domain
)
Module:
kernel
Layer:
kernel
kernel_signull_unlabeled(
domain
)
Module:
kernel
Layer:
kernel
kernel_sigstop_unlabeled(
domain
)
Module:
kernel
Layer:
kernel
kernel_unconfined(
domain
)
Unconfined access to the kernel.
Module:
kernel
Layer:
kernel
kernel_userland_entry(
domain
,
entrypoint
)
Module:
libraries
Layer:
system
libs_domtrans_ldconfig(
domain
)
Execute ldconfig in the ldconfig domain.
Module:
libraries
Layer:
system
libs_exec_ld_so(
domain
)
Execute the dynamic link/loader in the caller's domain.
Module:
libraries
Layer:
system
libs_exec_lib_files(
domain
)
Execute library scripts in the caller domain.
Module:
libraries
Layer:
system
libs_legacy_use_ld_so(
domain
)
Use the dynamic link/loader for automatic loading
of shared libraries with legacy support.
Module:
libraries
Layer:
system
libs_legacy_use_shared_libs(
domain
)
Load and execute functions from shared libraries,
with legacy support.
Module:
libraries
Layer:
system
libs_read_lib(
domain
)
Read files in the library directories, such
as static libraries.
Module:
libraries
Layer:
system
libs_run_ldconfig(
domain
,
role
,
terminal
)
Execute ldconfig in the ldconfig domain.
Module:
libraries
Layer:
system
libs_rw_ld_so_cache(
domain
)
Modify the dynamic link/loader's cached listing
of shared libraries.
Module:
libraries
Layer:
system
libs_use_ld_so(
domain
)
Use the dynamic link/loader for automatic loading
of shared libraries.
Module:
libraries
Layer:
system
libs_use_shared_libs(
domain
)
Load and execute functions from shared libraries.
Module:
locallogin
Layer:
system
locallogin_domtrans(
domain
)
Execute local logins in the local login domain.
Module:
locallogin
Layer:
system
locallogin_signull(
domain
)
Send a null signal to local login processes.
Module:
locallogin
Layer:
system
locallogin_use_fd(
domain
)
Allow processes to inherit local login file descriptors
Module:
logging
Layer:
system
logging_dontaudit_getattr_all_logs(
?
)
Module:
logging
Layer:
system
logging_exec_all_logs(
domain
)
Execute all log files in the caller domain.
Module:
logging
Layer:
system
logging_rw_log_dir(
domain
)
Read and write the generic log directory (/var/log).
Module:
logrotate
Layer:
admin
logrotate_domtrans(
domain
)
Execute logrotate in the logrotate domain.
Module:
logrotate
Layer:
admin
logrotate_dontaudit_use_fd(
domain
)
Do not audit attempts to inherit logrotate file descriptors.
Module:
logrotate
Layer:
admin
logrotate_exec(
domain
)
Execute logrotate in the caller domain.
Module:
logrotate
Layer:
admin
logrotate_run(
domain
,
role
,
terminal
)
Execute logrotate in the logrotate domain, and
allow the specified role the logrotate domain.
Module:
lvm
Layer:
system
lvm_domtrans(
domain
)
Module:
lvm
Layer:
system
lvm_read_config(
domain
)
Module:
lvm
Layer:
system
lvm_run(
domain
,
role
,
terminal
)
Module:
miscfiles
Layer:
system
miscfiles_legacy_read_localization(
domain
)
Module:
modutils
Layer:
system
modutils_domtrans_update_mods(
domain
)
Module:
modutils
Layer:
system
modutils_run_depmod(
domain
,
role
,
terminal
)
Module:
modutils
Layer:
system
modutils_run_insmod(
domain
,
role
,
terminal
)
Module:
modutils
Layer:
system
modutils_run_update_mods(
domain
,
role
,
terminal
)
Module:
mount
Layer:
system
mount_run(
domain
,
role
,
terminal
)
Module:
mount
Layer:
system
mount_send_nfs_client_request(
domain
)
Module:
mta
Layer:
services
mta_sendmail_mailserver(
domain
,
entry_point
)
Modified mailserver interface for
sendmail daemon use.
Module:
netutils
Layer:
admin
netutils_domtrans(
domain
)
Execute network utilities in the netutils domain.
Module:
netutils
Layer:
admin
netutils_domtrans_ping(
domain
)
Execute ping in the ping domain.
Module:
netutils
Layer:
admin
netutils_domtrans_traceroute(
domain
)
Execute traceroute in the traceroute domain.
Module:
netutils
Layer:
admin
netutils_exec(
domain
)
Execute network utilities in the caller domain.
Module:
netutils
Layer:
admin
netutils_exec_ping(
domain
)
Execute ping in the caller domain.
Module:
netutils
Layer:
admin
netutils_exec_traceroute(
domain
)
Execute traceroute in the caller domain.
Module:
netutils
Layer:
admin
netutils_run(
domain
,
role
,
terminal
)
Execute network utilities in the netutils domain, and
allow the specified role the netutils domain.
Module:
netutils
Layer:
admin
netutils_run_ping(
domain
,
role
,
terminal
)
Execute ping in the ping domain, and
allow the specified role the ping domain.
Module:
netutils
Layer:
admin
netutils_run_traceroute(
domain
,
role
,
terminal
)
Execute traceroute in the traceroute domain, and
allow the specified role the traceroute domain.
Module:
nis
Layer:
services
nis_list_var_yp(
domain
)
Send UDP network traffic to NIS clients.
Module:
nis
Layer:
services
nis_udp_sendto_ypbind(
domain
)
Send UDP network traffic to NIS clients.
Module:
nis
Layer:
services
nis_use_ypbind(
domain
)
Use the ypbind service to access NIS services.
Module:
rpm
Layer:
admin
rpm_domtrans(
domain
)
Execute rpm programs in the rpm domain.
Module:
rpm
Layer:
admin
rpm_manage_db(
domain
)
Create, read, write, and delete the RPM package database.
Module:
rpm
Layer:
admin
rpm_read_db(
domain
)
Read the RPM package database.
Module:
rpm
Layer:
admin
rpm_read_pipe(
domain
)
Module:
rpm
Layer:
admin
rpm_run(
domain
,
role
,
terminal
)
Execute RPM programs in the RPM domain.
Module:
rpm
Layer:
admin
rpm_use_fd(
domain
)
Inherit and use file descriptors from RPM.
Module:
selinux
Layer:
kernel
selinux_compute_access_vector(
domain
)
Module:
selinux
Layer:
kernel
selinux_compute_create_context(
domain
)
Module:
selinux
Layer:
kernel
selinux_compute_relabel_context(
domain
)
Module:
selinux
Layer:
kernel
selinux_compute_user_contexts(
domain
)
Module:
selinux
Layer:
kernel
selinux_set_boolean(
domain
,
[
booltype
]
)
Module:
selinuxutil
Layer:
system
seutil_search_default_contexts(
domain
)
Search the policy directory with default_context files.
Module:
ssh
Layer:
services
ssh_dontaudit_read_server_keys(
domain
)
Module:
storage
Layer:
kernel
storage_create_fixed_disk(
domain
)
Create block devices in /dev with the fixed disk type.
Module:
storage
Layer:
kernel
storage_dontaudit_getattr_fixed_disk(
domain
)
Do not audit attempts made by the caller to get
the attributes of fixed disk device nodes.
Module:
storage
Layer:
kernel
storage_dontaudit_getattr_removable_device(
domain
)
Do not audit attempts made by the caller to get
the attributes of removable devices device nodes.
Module:
storage
Layer:
kernel
storage_dontaudit_setattr_fixed_disk(
domain
)
Do not audit attempts made by the caller to set
the attributes of fixed disk device nodes.
Module:
storage
Layer:
kernel
storage_dontaudit_setattr_removable_device(
domain
)
Do not audit attempts made by the caller to set
the attributes of removable devices device nodes.
Module:
storage
Layer:
kernel
storage_getattr_fixed_disk(
domain
)
Allow the caller to get the attributes of fixed disk
device nodes.
Module:
storage
Layer:
kernel
storage_getattr_removable_device(
domain
)
Allow the caller to get the attributes of removable
devices device nodes.
Module:
storage
Layer:
kernel
storage_getattr_scsi_generic(
domain
)
Allow the caller to get the attributes of
the generic SCSI interface device nodes.
Module:
storage
Layer:
kernel
storage_getattr_scsi_generic(
domain
)
Get attributes of the device nodes
for the SCSI generic inerface.
Module:
storage
Layer:
kernel
storage_getattr_tape_device(
domain
)
Allow the caller to get the attributes
of device nodes of tape devices.
Module:
storage
Layer:
kernel
storage_manage_fixed_disk(
domain
)
Create, read, write, and delete fixed disk device nodes.
Module:
storage
Layer:
kernel
storage_raw_read_fixed_disk(
domain
)
Allow the caller to directly read from a fixed disk.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_raw_read_lvm_volume(
domain
)
Allow the caller to directly read from a logical volume.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_raw_read_removable_device(
domain
)
Allow the caller to directly read from
a removable device.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_raw_write_fixed_disk(
domain
)
Allow the caller to directly write to a fixed disk.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_raw_write_lvm_volume(
domain
)
Allow the caller to directly read from a logical volume.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_raw_write_removable_device(
domain
)
Allow the caller to directly write to
a removable device.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_read_scsi_generic(
domain
)
Allow the caller to directly read, in a
generic fashion, from any SCSI device.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_read_tape_device(
domain
)
Allow the caller to directly read
a tape device.
Module:
storage
Layer:
kernel
storage_relabel_fixed_disk(
domain
)
Relabel fixed disk device nodes.
Module:
storage
Layer:
kernel
storage_set_scsi_generic_attributes(
domain
)
Set attributes of the device nodes
for the SCSI generic inerface.
Module:
storage
Layer:
kernel
storage_setattr_fixed_disk(
domain
)
Allow the caller to set the attributes of fixed disk
device nodes.
Module:
storage
Layer:
kernel
storage_setattr_removable_device(
domain
)
Allow the caller to set the attributes of removable
devices device nodes.
Module:
storage
Layer:
kernel
storage_setattr_scsi_generic(
domain
)
Allow the caller to set the attributes of
the generic SCSI interface device nodes.
Module:
storage
Layer:
kernel
storage_setattr_tape_device(
domain
)
Allow the caller to set the attributes
of device nodes of tape devices.
Module:
storage
Layer:
kernel
storage_swapon_fixed_disk(
domain
)
Enable a fixed disk device as swap space
Module:
storage
Layer:
kernel
storage_unconfined(
domain
)
Unconfined access to storage devices.
Module:
storage
Layer:
kernel
storage_write_scsi_generic(
domain
)
Allow the caller to directly write, in a
generic fashion, from any SCSI device.
This is extremly dangerous as it can bypass the
SELinux protections for filesystem objects, and
should only be used by trusted domains.
Module:
storage
Layer:
kernel
storage_write_tape_device(
domain
)
Allow the caller to directly read
a tape device.
Module:
sysnetwork
Layer:
system
sysnet_kill_dhcpc(
domain
)
Send a kill signal to the dhcp client.
Module:
sysnetwork
Layer:
system
sysnet_read_config(
domain
)
Allow network init to read network config files.
Module:
sysnetwork
Layer:
system
sysnet_read_dhcpc_pid(
domain
)
Read the dhcp client pid file.
Module:
sysnetwork
Layer:
system
sysnet_read_dhcpc_state(
domain
)
Read dhcp client state files.
Module:
sysnetwork
Layer:
system
sysnet_run_ifconfig(
domain
,
role
,
terminal
)
Module:
sysnetwork
Layer:
system
sysnet_rw_dhcp_config(
domain
)
Read and write dhcp configuration files.
Module:
sysnetwork
Layer:
system
sysnet_sigchld_dhcpc(
domain
)
Send a SIGCHLD signal to the dhcp client.
Module:
sysnetwork
Layer:
system
sysnet_signal_dhcpc(
domain
)
Send a generic signal to the dhcp client.
Module:
sysnetwork
Layer:
system
sysnet_signull_dhcpc(
domain
)
Send a null signal to the dhcp client.
Module:
sysnetwork
Layer:
system
sysnet_sigstop_dhcpc(
domain
)
Send a SIGSTOP signal to the dhcp client.
Module:
terminal
Layer:
kernel
term_dontaudit_getattr_all_user_ttys(
domain
)
Module:
terminal
Layer:
kernel
term_dontaudit_use_all_user_ptys(
domain
)
Module:
terminal
Layer:
kernel
term_dontaudit_use_all_user_ttys(
domain
)
Module:
terminal
Layer:
kernel
term_dontaudit_use_generic_pty(
domain
)
Module:
terminal
Layer:
kernel
term_dontaudit_use_unallocated_tty(
domain
)
Module:
terminal
Layer:
kernel
term_getattr_unallocated_ttys(
domain
)
Module:
terminal
Layer:
kernel
term_relabel_unallocated_ttys(
domain
)
Module:
terminal
Layer:
kernel
term_setattr_unallocated_ttys(
domain
)
Module:
terminal
Layer:
kernel
term_user_pty(
userdomain
,
object_type
)
Module:
udev
Layer:
system
udev_domtrans(
domain
)
Module:
unconfined
Layer:
system
unconfined_domtrans_shell(
domain
)
Transition to the unconfined domain by executing a shell.
Module:
unconfined
Layer:
system
unconfined_role(
domain
)
Add the unconfined domain to the specified role.
Module:
unconfined
Layer:
system
unconfined_rw_pipe(
domain
)
Read and write unconfined domain unnamed pipes.
Module:
unconfined
Layer:
system
unconfined_sigchld(
domain
)
Send a SIGCHLD signal to the unconfined domain.
Module:
unconfined
Layer:
system
unconfined_use_fd(
domain
)
Inherit file descriptors from the unconfined domain.
Module:
userdomain
Layer:
system
userdom_dontaudit_use_sysadm_terms(
domain
)
Do not audit attempts to use admin ttys and ptys.
Module:
userdomain
Layer:
system
userdom_dontaudit_use_unpriv_user_fd(
domain
)
Do not audit attempts to inherit the
file descriptors from all user domains.
Module:
userdomain
Layer:
system
userdom_dontaudit_use_unpriv_user_tty(
domain
)
Do not audit attempts to use unprivileged
user ttys.
Module:
userdomain
Layer:
system
userdom_read_all_user_files(
domain
)
Read all files in all users home directories.
Module:
userdomain
Layer:
system
userdom_read_staff_home_files(
domain
)
Read files in the staff users home directory.
Module:
userdomain
Layer:
system
userdom_read_sysadm_home_files(
domain
)
Read files in the sysadm users home directory.
Module:
userdomain
Layer:
system
userdom_rw_sysadm_pipe(
domain
)
Read and write sysadm user unnamed pipes.
Module:
userdomain
Layer:
system
userdom_search_all_users_home(
domain
)
Search all users home directories.
Module:
userdomain
Layer:
system
userdom_shell_domtrans_sysadm(
domain
)
Execute a shell in the sysadm domain.
Module:
userdomain
Layer:
system
userdom_signal_all_users(
domain
)
Send general signals to all user domains.
Module:
userdomain
Layer:
system
userdom_signal_unpriv_users(
domain
)
Send general signals to unprivileged user domains.
Module:
userdomain
Layer:
system
userdom_spec_domtrans_all_users(
domain
)
Execute a shell in all user domains. This
is an explicit transition, requiring the
caller to use setexeccon().
Module:
userdomain
Layer:
system
userdom_spec_domtrans_unpriv_users(
domain
)
Execute a shell in all unprivileged user domains. This
is an explicit transition, requiring the
caller to use setexeccon().
Module:
userdomain
Layer:
system
userdom_unconfined(
domain
)
Unconfined access to user domains.
Module:
userdomain
Layer:
system
userdom_use_all_user_fd(
domain
)
Inherit the file descriptors from all user domains
Module:
userdomain
Layer:
system
userdom_use_sysadm_fd(
domain
)
Inherit and use sysadm file descriptors
Module:
userdomain
Layer:
system
userdom_use_sysadm_pty(
domain
)
Read and write sysadm ptys.
Module:
userdomain
Layer:
system
userdom_use_sysadm_terms(
domain
)
Read and write sysadm ttys and ptys.
Module:
userdomain
Layer:
system
userdom_use_sysadm_tty(
domain
)
Read and write sysadm ttys.
Module:
userdomain
Layer:
system
userdom_use_unpriv_users_fd(
domain
)
Inherit the file descriptors from unprivileged user domains.
Module:
userdomain
Layer:
system
userdom_write_unpriv_user_tmp(
domain
)
Write all unprivileged users files in /tmp
Module:
usermanage
Layer:
admin
usermanage_run_chfn(
domain
,
role
,
terminal
)
Module:
usermanage
Layer:
admin
usermanage_run_groupadd(
domain
,
role
,
terminal
)
Module:
usermanage
Layer:
admin
usermanage_run_passwd(
domain
,
role
,
terminal
)
Module:
usermanage
Layer:
admin
usermanage_run_useradd(
domain
,
role
,
terminal
)